Anonymous: Enforce org role Viewer setting (#102070)

* Anon: Remove org role setting

* remove from ini

* remove setting from documentation

conf/defaults.ini

@@ -677,9 +677,6 @@ enabled = false
 # specify organization name that should be used for unauthenticated users
 org_name = Main Org.
 
-# specify role for unauthenticated users
-org_role = Viewer
-
 # mask the Grafana version number for unauthenticated users
 hide_version = false
 

conf/sample.ini

@@ -665,9 +665,6 @@
 # specify organization name that should be used for unauthenticated users
 ;org_name = Main Org.
 
-# specify role for unauthenticated users
-;org_role = Viewer
-
 # mask the Grafana version number for unauthenticated users
 ;hide_version = false
 

docs/sources/setup-grafana/configure-security/configure-authentication/anonymous-auth/index.md

@@ -54,9 +54,6 @@ enabled = true
 # Organization name that should be used for unauthenticated users
 org_name = Main Org.
 
-# Role for unauthenticated users, other valid values are `Editor` and `Admin`
-org_role = Viewer
-
 # Hide the Grafana version text from the footer and help tooltip for unauthenticated users (default: false)
 hide_version = true
 

pkg/services/accesscontrol/dualwrite/collectors.go

@@ -10,6 +10,7 @@ import (
 	authzextv1 "github.com/grafana/grafana/pkg/services/authz/proto/v1"
 	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 	"github.com/grafana/grafana/pkg/services/folder"
+	"github.com/grafana/grafana/pkg/services/org"
 	"github.com/grafana/grafana/pkg/setting"
 )
 
@@ -469,7 +470,7 @@ func fixedRolePermissionsCollector(store db.DB) legacyTupleCollector {
 func anonymousRoleBindingsCollector(cfg *setting.Cfg, store db.DB) legacyTupleCollector {
 	return func(ctx context.Context, orgID int64) (map[string]map[string]*openfgav1.TupleKey, error) {
 		tuples := make(map[string]map[string]*openfgav1.TupleKey)
-		object := zanzana.NewTupleEntry(zanzana.TypeRole, zanzana.TranslateBasicRole(cfg.Anonymous.OrgRole), "")
+		object := zanzana.NewTupleEntry(zanzana.TypeRole, zanzana.TranslateBasicRole(string(org.RoleViewer)), "")
 		// Object should be set to delete obsolete permissions
 		tuples[object] = make(map[string]*openfgav1.TupleKey)
 

pkg/services/anonymous/anonimpl/client.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"errors"
 	"net/http"
-	"strings"
 
 	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/apimachinery/errutil"
@@ -94,18 +93,6 @@ func (a *Anonymous) ResolveIdentity(ctx context.Context, orgID int64, typ claims
 	return a.newAnonymousIdentity(o), nil
 }
 
-func (a *Anonymous) UsageStatFn(ctx context.Context) (map[string]any, error) {
-	m := map[string]any{}
-
-	// Add stats about anonymous auth
-	m["stats.anonymous.customized_role.count"] = 0
-	if !strings.EqualFold(a.cfg.Anonymous.OrgRole, "Viewer") {
-		m["stats.anonymous.customized_role.count"] = 1
-	}
-
-	return m, nil
-}
-
 func (a *Anonymous) Priority() uint {
 	return 100
 }
@@ -116,7 +103,7 @@ func (a *Anonymous) newAnonymousIdentity(o *org.Org) *authn.Identity {
 		Type:         claims.TypeAnonymous,
 		OrgID:        o.ID,
 		OrgName:      o.Name,
-		OrgRoles:     map[int64]org.RoleType{o.ID: org.RoleType(a.cfg.Anonymous.OrgRole)},
+		OrgRoles:     map[int64]org.RoleType{o.ID: org.RoleViewer},
 		ClientParams: authn.ClientParams{SyncPermissions: true},
 	}
 }

pkg/services/anonymous/anonimpl/client_test.go

@@ -31,7 +31,6 @@ func TestAnonymous_Authenticate(t *testing.T) {
 			org:  &org.Org{ID: 1, Name: "some org"},
 			cfg: &setting.Cfg{
 				Anonymous: setting.AnonymousSettings{
-					OrgRole: "Viewer",
 					OrgName: "some org",
 				},
 			},
@@ -41,7 +40,6 @@ func TestAnonymous_Authenticate(t *testing.T) {
 			err:  fmt.Errorf("some error"),
 			cfg: &setting.Cfg{
 				Anonymous: setting.AnonymousSettings{
-					OrgRole: "Viewer",
 					OrgName: "some org",
 				},
 			},
@@ -67,7 +65,6 @@ func TestAnonymous_Authenticate(t *testing.T) {
 				assert.Equal(t, "anonymous:0", user.GetID())
 				assert.Equal(t, tt.org.ID, user.OrgID)
 				assert.Equal(t, tt.org.Name, user.OrgName)
-				assert.Equal(t, tt.cfg.Anonymous.OrgRole, string(user.GetOrgRole()))
 			}
 		})
 	}

pkg/services/searchV2/service.go

@@ -165,7 +165,7 @@ func (s *StandardSearchService) getUser(ctx context.Context, backendUser *backen
 		usr = &user.SignedInUser{
 			OrgID:       orga.ID,
 			OrgName:     orga.Name,
-			OrgRole:     org.RoleType(s.cfg.Anonymous.OrgRole),
+			OrgRole:     org.RoleViewer,
 			IsAnonymous: true,
 		}
 	} else {

pkg/setting/setting_anonymous.go

@@ -3,7 +3,6 @@ package setting
 type AnonymousSettings struct {
 	Enabled     bool
 	OrgName     string
-	OrgRole     string
 	HideVersion bool
 	DeviceLimit int64
 }
@@ -14,12 +13,7 @@ func (cfg *Cfg) readAnonymousSettings() {
 	anonSettings := AnonymousSettings{}
 	anonSettings.Enabled = anonSection.Key("enabled").MustBool(false)
 	anonSettings.OrgName = valueAsString(anonSection, "org_name", "")
-	// Deprecated:
-	// only viewer role is supported
-	anonSettings.OrgRole = valueAsString(anonSection, "org_role", "")
-	if anonSettings.OrgRole != "Viewer" {
-		cfg.Logger.Warn("auth.anonymous.org_role is deprecated, only viewer role is supported")
-	}
+
 	anonSettings.HideVersion = anonSection.Key("hide_version").MustBool(false)
 	anonSettings.DeviceLimit = anonSection.Key("device_limit").MustInt64(0)
 	cfg.Anonymous = anonSettings